@anywalletkit/protocol-swap2-omniston 0.2.8 → 0.3.1

package/README.md

@@ -34,6 +34,14 @@ Every route is fail-closed until its allowlists and validators are configured:
   wallets, pTON wallet ownership and DeDust pool pairs on chain.
   `tonSwapPayloadCheck: "report"` traces `ton-swap-payload <reason>` instead
   of refusing (default `"enforce"`).
+  Behind `remoteProvider`, the app checks the built body itself:
+  `remoteProvider({name: "omniston", baseUrl, verifyBuild: omnistonVerifyBuild({...createOmnistonTonValidators()})})`.
+  A TON → TON swap body is opened with `checkTonSwapPayload` against the app's own request (receiver,
+  refund, on-chain minimum, input; the quote carries `routeSteps`) and the DEX it pays is confirmed with
+  the app's validators. A TON → EVM escrow body goes to `verifyTonEscrowBuild`: the jetton amount, the
+  trader as owner, the destination chain, address and token and the quote's minimum delivery come from
+  the app, the protocol contract from `trustedProtocolAddresses`, and the escrow code, authority key and
+  timelocks are the audited ones. Without `verifyBuild` the engine refuses remote cell bodies.
 - **TON → EVM** (HTLC order, the wallet pays a jetton escrow): factory
   allowlisted on both chains, `validateTonJettonWallet`,
   `validateTonEscrowPayload`, `validateEvmOutputPosition`.
@@ -48,6 +56,13 @@ Every route is fail-closed until its allowlists and validators are configured:
   `validateEvmInputPosition` (finalized `SrcEscrowCreated` + escrow state)
   AND `validateTonOutputPosition` (factory-deployed TON position with bound
   state, inside its completion window) both pass.
+  Behind `remoteProvider` the order is built on your server, so the app pins
+  the order protocols itself: `remoteProvider({name: "omniston", baseUrl,
+  ...omnistonPins(trustedEvmOrderProtocols)})` — the same audited table. The
+  engine then signs only an `Order` whose verifying contract is a pinned
+  spender, whose maker is this account and that sells exactly the swap's input
+  of the source token; a `Permit` or any other typed message is refused.
+  `validateEvmTypedOrder` is exported for apps that hold the settlement data.
 - **EVM → EVM** (gasless order, same order protocol as EVM → TON): the signed
   extension's ExtraDataArgs name the destination chain, token and deposit and
   are checked against the quote. The EVM recipient is NOT in anything the
@@ -74,7 +89,11 @@ escrow, not that transaction), `AUDITED_OMNISTON_SETTLEMENT_CONTRACTS`,
 own endpoints as `rpcUrls` (CAIP-2 → URLs, tried before the public fallbacks)
 and `tonApiUrl` / `tonApiKey`. On serverless also inject durable
 `secretStore` / `quoteStore` — the HTLC secret must survive to the poll that
-discloses it.
+discloses it. Give the quote store a `claim` (an atomic create-if-absent: Redis
+`SET NX`, a conditional KV put): the platform picks quote ids, and a context is
+never rebound to another user's quote under the same id. A secret is disclosed
+only against the exact order it was locked to (its stored binding), so even a
+rebound context gets nothing.
 
 The destination-escrow proof requires the escrow immutables to be found in the
 resolver's calldata AND to derive, through the trusted factory's

package/dist/{chunk-KNT2XSQU.js → chunk-HOTFZYSW.js}

@@ -342,7 +342,12 @@ function inMemoryQuoteStore() {
   return {
     save: (id, v) => void map.set(id, v),
     load: (id) => map.get(id),
-    clear: (id) => void map.delete(id)
+    clear: (id) => void map.delete(id),
+    claim: (id, v) => {
+      if (map.has(id)) return false;
+      map.set(id, v);
+      return true;
+    }
   };
 }
 function inMemorySecretStore() {
@@ -916,6 +921,13 @@ function validSwapSettlement(q) {
   const v = q.settlementData.value;
   return Array.isArray(v.routes) && v.routes.length > 0 && v.routes.every((route) => Array.isArray(route?.steps) && route.steps.length > 0 && route.steps.every((step) => Array.isArray(step?.chunks) && step.chunks.length > 0 && step.chunks.every((chunk) => typeof chunk?.protocol === "string" && chunk.protocol.length > 0 && isPositiveInteger(chunk.inputUnits) && isPositiveInteger(chunk.outputUnits)))) && isPositiveInteger(v.minOutputAmount) && BigInt(v.minOutputAmount) <= BigInt(q.outputUnits) && (v.recommendedMinOutputAmount === void 0 || isPositiveInteger(v.recommendedMinOutputAmount) && BigInt(v.recommendedMinOutputAmount) <= BigInt(q.outputUnits)) && (q.gasBudget === void 0 || isPositiveInteger(q.gasBudget));
 }
+function swapSteps(v) {
+  if (v.routes.length !== 1) return [{ protocol: `${v.routes.length}-routes`, inputJetton: void 0, outputJetton: void 0 }];
+  return v.routes[0].steps.map((step) => {
+    if (step.chunks.length !== 1) return { protocol: `split(${step.chunks.map((c) => c.protocol).join("|")})`, inputJetton: void 0, outputJetton: void 0 };
+    return { protocol: step.chunks[0].protocol, inputJetton: stepJetton(step.inputAsset), outputJetton: stepJetton(step.outputAsset) };
+  });
+}
 function swapProtocols(v) {
   const names = /* @__PURE__ */ new Set();
   for (const route of v.routes) for (const step of route.steps) for (const chunk of step.chunks) names.add(chunk.protocol);
@@ -1092,6 +1104,86 @@ function mapOrderStatus(order) {
       return { state: "pending", depositReceived };
   }
 }
+function omnistonPins(trustedEvmOrderProtocols) {
+  const byChain = new Map(Object.entries(trustedEvmOrderProtocols).map(([chain, list]) => [chain, list.map((a) => getAddress(a))]));
+  return Object.freeze({ callTargets: () => [], spenders: (chain) => byChain.get(chain) ?? [] });
+}
+function omnistonVerifyBuild(hooks) {
+  return async (quote, tx, params) => {
+    if (tx.bodyBoc === void 0) return null;
+    if (!params) return "the request this quote answered is unknown";
+    if (quote.providerData?.settlement !== "swap") {
+      if (params.sourceChain.startsWith("ton:") && params.destChain.startsWith("eip155:")) {
+        if (!hooks.verifyTonEscrowBuild) return "a TON \u2192 EVM escrow body needs verifyTonEscrowBuild (createOmnistonTonValidators)";
+        if (!params.refundAddress) return "the trader's TON address (refundAddress) is unknown";
+        const floor = [quote.minDestAmount, params.minAmountOut ?? "0"].filter((v) => /^\d{1,80}$/.test(v)).map((v) => BigInt(v)).reduce((a, b) => a > b ? a : b, 0n);
+        try {
+          return await hooks.verifyTonEscrowBuild({
+            payloadBocHex: Buffer2.from(tx.bodyBoc, "base64").toString("hex"),
+            ownerAddress: params.refundAddress,
+            inputUnits: quote.sourceAmount,
+            destinationChain: params.destChain,
+            destinationAddress: params.destAddress,
+            outputTokenAddress: params.destToken,
+            minResolverSendsUnits: floor.toString()
+          });
+        } catch {
+          return "the escrow body could not be checked";
+        }
+      }
+      return "only TON swap and TON \u2192 EVM escrow bodies can be checked on the client";
+    }
+    let steps;
+    try {
+      steps = JSON.parse(quote.providerData.routeSteps ?? "");
+    } catch {
+      return "the quote carries no route steps";
+    }
+    if (!Array.isArray(steps) || steps.length === 0) return "the quote carries no route steps";
+    const source = ccAsset(params.sourceChain, params.sourceToken);
+    const dest = ccAssetByToken(params.destChain, params.destToken);
+    if (!source || !dest) return "unknown source or destination token";
+    const protocols = (quote.providerData.protocols ?? "").split(",").filter(Boolean);
+    let checked;
+    try {
+      checked = checkTonSwapPayload({
+        payloadHex: Buffer2.from(tx.bodyBoc, "base64").toString("hex"),
+        targetAddress: tx.to,
+        sendAmount: BigInt(tx.value),
+        trader: params.refundAddress ?? "",
+        dest: params.destAddress,
+        inputUnits: quote.sourceAmount,
+        minOutputAmount: quote.minDestAmount,
+        inputJetton: source.contract ?? null,
+        outputJetton: dest.contract ?? null,
+        steps: steps.map((st) => ({ protocol: String(st.protocol), inputJetton: st.inputJetton, outputJetton: st.outputJetton })),
+        integratorAddress: hooks.integratorAddress ?? null
+      });
+    } catch (e) {
+      return e instanceof Error ? e.message.replace(/^omniston: /, "") : String(e);
+    }
+    const payload = parseSwapPayload(Buffer2.from(tx.bodyBoc, "base64").toString("hex"));
+    const target = source.contract ? payload.jettonTransfer?.destination : tx.to;
+    if (!target) return "the body names no swap destination";
+    try {
+      if (!await hooks.validateTonSwapTarget({ address: target, protocols })) return `${target} is not a recognized DEX contract for ${protocols.join("+")}`;
+    } catch {
+      return "the swap target could not be checked";
+    }
+    if (hooks.validateTonSwapLeg) {
+      for (const leg of checked.legs) {
+        let ok = false;
+        try {
+          ok = await hooks.validateTonSwapLeg(leg);
+        } catch {
+          ok = false;
+        }
+        if (!ok) return `${leg.kind} v${leg.version} leg not verified`;
+      }
+    }
+    return null;
+  };
+}
 function omnistonProvider(opts = {}) {
   opts = Object.freeze({ ...opts });
   const apiUrl = opts.apiUrl ?? "wss://omni-ws.ston.fi";
@@ -1209,6 +1301,26 @@ function omnistonProvider(opts = {}) {
   async function saveBuilt(quoteId, entry) {
     await quotes.save(quoteId, JSON.stringify(entry));
   }
+  async function claimBuilt(quoteId, entry) {
+    const json = JSON.stringify(entry);
+    if (typeof quotes.claim === "function") {
+      if (await quotes.claim(quoteId, json)) return true;
+    } else if (!await quotes.load(quoteId)) {
+      await quotes.save(quoteId, json);
+      return true;
+    }
+    const existing = await loadBuilt(quoteId);
+    if (!existing) {
+      if (typeof quotes.claim === "function") return await quotes.claim(quoteId, json);
+      await quotes.save(quoteId, json);
+      return true;
+    }
+    const a = existing.bound, b = entry.bound;
+    const same = !!a && !!b && a.kind === b.kind && a.srcChain === b.srcChain && sameIntentAddress(a.trader, b.trader) && sameIntentAddress(a.dest, b.dest);
+    if (!same) return false;
+    await quotes.save(quoteId, json);
+    return true;
+  }
   async function loadBuilt(quoteId) {
     const raw = await quotes.load(quoteId);
     if (!raw) return void 0;
@@ -1375,7 +1487,10 @@ function omnistonProvider(opts = {}) {
     if (BigInt(swap.minOutputAmount) < requiredMin(q.outputUnits)) return null;
     if (q.gasBudget !== void 0 && BigInt(q.gasBudget) > BigInt(maxTonExecutionNano)) return null;
     const minOut = swap.minOutputAmount;
-    await saveBuilt(q.quoteId, { quote: q, at: Date.now(), bound: { trader, dest: params.destAddress, srcChain: params.sourceChain, kind: "swap" } });
+    if (!await claimBuilt(q.quoteId, { quote: q, at: Date.now(), bound: { trader, dest: params.destAddress, srcChain: params.sourceChain, kind: "swap" } })) {
+      traceFor(q.quoteId)("quote-id-reused", { kind: "swap" });
+      return null;
+    }
     const feeUnits = Number(q.protocolFeeUnits || "0") + Number(q.integratorFeeUnits || "0");
     const stableOut = /^(USDT|USDC|USD₮|jUSDT)$/.test(dest.symbol);
     const feeUsd = stableOut ? feeUnits / 10 ** dest.decimals : 0;
@@ -1402,6 +1517,8 @@ function omnistonProvider(opts = {}) {
       providerData: {
         settlement: "swap",
         protocols: swapProtocols(swap).join(","),
+        // For the app's own check of a remote build (omnistonVerifyBuild): the route the body must follow.
+        routeSteps: JSON.stringify(swapSteps(swap)),
         ...q.gasBudget ? { gasBudget: q.gasBudget } : {},
         ...q.estimatedGasConsumption ? { gasEstimate: q.estimatedGasConsumption } : {}
       }
@@ -1502,10 +1619,7 @@ function omnistonProvider(opts = {}) {
         minOutputAmount: swap.minOutputAmount,
         inputJetton,
         outputJetton: assetContract(q.outputAsset),
-        steps: swap.routes.length === 1 ? routeSteps.map((step) => {
-          if (step.chunks.length !== 1) return { protocol: `split(${step.chunks.map((c) => c.protocol).join("|")})`, inputJetton: void 0, outputJetton: void 0 };
-          return { protocol: step.chunks[0].protocol, inputJetton: stepJetton(step.inputAsset), outputJetton: stepJetton(step.outputAsset) };
-        }) : [{ protocol: `${swap.routes.length}-routes`, inputJetton: void 0, outputJetton: void 0 }],
+        steps: swapSteps(swap),
         integratorAddress: q.integratorAddress?.chain.$case === "ton" ? q.integratorAddress.chain.value : null
       });
     } catch (error) {
@@ -1793,7 +1907,9 @@ function omnistonProvider(opts = {}) {
       const outputScaled = BigInt(q.outputUnits) * 10n ** BigInt(source.decimals);
       if (outputScaled * 2n < inputScaled || outputScaled > inputScaled * 2n) return refuse2("quoted output is outside 0.5x\u20132x of the input");
       if (await quoteIdInUse(q.quoteId)) return refuse2("the platform reused a quote id that already belongs to an order");
-      await saveBuilt(q.quoteId, { quote: q, at: Date.now(), bound: { trader, dest: params.destAddress, srcChain: params.sourceChain, kind: "order" } });
+      if (!await claimBuilt(q.quoteId, { quote: q, at: Date.now(), bound: { trader, dest: params.destAddress, srcChain: params.sourceChain, kind: "order" } })) {
+        return refuse2("the platform reused a quote id that already holds another user's quote");
+      }
       const feeUnits = Number(q.protocolFeeUnits || "0") + Number(q.integratorFeeUnits || "0");
       const feeUsd = feeUnits / 10 ** dest.decimals;
       return {
@@ -1925,6 +2041,7 @@ function omnistonProvider(opts = {}) {
         await forget();
         throw error;
       }
+      await saveBuilt(ref.quoteId, { quote: q, at: Date.now(), ...cached.bound ? { bound: cached.bound } : {} });
       return {
         chain: srcChain,
         to: message.targetAddress,
@@ -1968,8 +2085,15 @@ function omnistonProvider(opts = {}) {
         })
       );
       if (!order) return { state: "pending" };
-      const secretsHex = await store.load(decoded.quoteId);
+      let secretsHex = await store.load(decoded.quoteId);
       if (!secretsHex || cached?.quote.settlementData.$case !== "order") trace("disclosure-skipped", { gate: "context", secrets: !!secretsHex, cached: !!cached, feedStatus: order.status });
+      if (secretsHex && cached?.quote.settlementData.$case === "order") {
+        const [lockedTo] = await store.load(bindKey(decoded.quoteId)) ?? [];
+        if (lockedTo !== orderBinding(bound, cached.quote)) {
+          trace("disclosure-skipped", { gate: "binding", bound: lockedTo !== void 0, feedStatus: order.status });
+          secretsHex = void 0;
+        }
+      }
       if (secretsHex && cached?.quote.settlementData.$case === "order") {
         const q = cached.quote;
         const settlement = q.settlementData.value;
@@ -2144,6 +2268,9 @@ export {
   inMemorySecretStore,
   encodeTypedMessage,
   validateEvmToTonOrderExtension,
+  validateEvmTypedOrder,
+  omnistonPins,
+  omnistonVerifyBuild,
   omnistonProvider
 };
-//# sourceMappingURL=chunk-KNT2XSQU.js.map
+//# sourceMappingURL=chunk-HOTFZYSW.js.map